Repository navigation
[fix] Cap server dependency major versions - #15948
Conversation
Cap the previously-uncapped server-related runtime dependencies (starlette, uvicorn, httptools, anyio, python-multipart, websockets, itsdangerous) at the next unreleased major version to minimize breaks from future major releases. Document the dependency-capping policy in the Python agent guides.
lukasmasuch
added
impact:internal
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
✅ PR preview is ready!
|
|
Note on labeling: I labeled this |
lukasmasuch
added
the
ai-review
|
| Filename | Overview |
|---|---|
| lib/pyproject.toml | Adds upper bounds to required runtime dependencies. |
| lib/AGENTS.md | Documents the required dependency bound policy. |
| .cursor/rules/python.mdc | Mirrors the dependency policy in generated Cursor guidance. |
| .github/instructions/python.instructions.md | Mirrors the dependency policy in generated GitHub instructions. |
Reviews (3): Last reviewed commit: "Merge remote-tracking branch 'origin/dev..." | Re-trigger Greptile
github-actions
Bot
removed
the
ai-review
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Summary
This PR adds upper version bounds (capped at the next unreleased major version) to seven previously-uncapped server-related runtime dependencies in lib/pyproject.toml: starlette<2, uvicorn<1, httptools<1, anyio<5, python-multipart<1, websockets<17, itsdangerous<3. It also documents the dependency-capping policy in the agent guide files (lib/AGENTS.md, .cursor/rules/python.mdc, .github/instructions/python.instructions.md).
Code Quality
Both reviewers agree the changes are clean and well-structured:
- The new caps follow the established
>=lower,<next_majorpattern already used by other capped dependencies (e.g.,blinker>=1.5.0,<2,requests>=2.27,<3). - Documentation additions are consistent across all three agent guide files.
- Existing exemptions (
packaging>=20,pyarrow>=7.0) already have explanatory comments, aligning with the newly codified policy.
No structural or maintainability issues were identified.
Test Coverage
Both reviewers agree no tests are needed. These are purely dependency metadata changes with no runtime behavior impact. All upper bounds sit above the currently-resolved latest versions, so dependency resolution is unaffected and existing test coverage remains applicable.
Backwards Compatibility
Both reviewers confirm no breaking changes. All upper bounds are above currently-installed versions, meaning existing installations will continue to resolve the same versions. The caps only prevent future major-version upgrades from being automatically pulled in — the intended protective behavior.
Security & Risk
Both reviewers agree there are no security concerns. The dependency caps are a risk-reduction measure that prevents untested major version upgrades of server-critical packages (ASGI framework, HTTP server, WebSocket library, cookie signing) from being automatically installed. No runtime code is touched.
External test recommendation
- Recommend external_test: No
- Triggered categories: None
- Key evidence:
lib/pyproject.toml: Dependency version caps only — no changes to routing, auth, WebSocket handling, embedding, assets, CORS, security headers, or any runtime code.lib/AGENTS.md,.cursor/rules/python.mdc,.github/instructions/python.instructions.md: Internal developer documentation/policy text only.
- Suggested external test focus areas: None for this PR. When these dependencies are later bumped to new majors, validate external deployments for websocket/session continuity, uploads, and embedded/proxied routing behavior.
- Confidence: High
- Assumptions/gaps: Assessment assumes no unpublished companion PR modifies runtime server code in tandem.
Accessibility
Not applicable — no frontend or UI changes.
Recommendations
- (Optional) Consider adding a lightweight CI check that enforces upper bounds for required runtime dependencies in
lib/pyproject.toml(with explicit exemptions) to keep this policy automatically enforced over time. (Raised by gpt-5.3-codex-high) - (Optional) Several optional dependencies (
httpx>=0.24.1,matplotlib>=3.0.0,plotly>=4.0.0, etc.) also lack upper bounds. These are outside the scope of this server-focused PR but could be addressed in a follow-up for full policy consistency. (Raised by claude-4.6-opus-high-thinking)
Reviewer Agreement
Both reviewers (claude-4.6-opus-high-thinking and gpt-5.3-codex-high) are in full agreement:
- Verdict: Both approve unconditionally.
- Risk assessment: Both rate the PR as low-risk with no blocking issues.
- External test: Both recommend no external test coverage is needed.
- No disagreements were identified between the two reviews.
Verdict
APPROVED: Clean, low-risk change that adds protective upper version bounds to server dependencies and documents the capping policy. All caps are above currently-installed versions with no runtime impact. Both reviewers approve unanimously with no blocking issues.
This is a consolidated AI review by claude-4.6-opus-high-thinking, synthesizing reviews from claude-4.6-opus-high-thinking and gpt-5.3-codex-high.
|
Thanks for the review! Both optional recommendations from the consolidated AI review are intentionally left out of scope to keep this a focused dependency-hygiene chore:
The newly documented policy in the agent guides captures the intent so future additions get capped by default. |
lukasmasuch
changed the title
lukasmasuch
added
type:bug
lukasmasuch
changed the title
lukasmasuch
added
change:bugfix
There was a problem hiding this comment.
Summary
This PR adds upper version bounds (<NEXT_MAJOR) to seven previously-uncapped server/runtime dependencies in lib/pyproject.toml (starlette, uvicorn, httptools, anyio, python-multipart, websockets, itsdangerous) and pins pyarrow<25.0.0 to avoid a known crash (apache/arrow#50471). It also documents the dependency-capping policy in lib/AGENTS.md and its mirrored agent-instruction files (.cursor/rules/python.mdc, .github/instructions/python.instructions.md).
Reviewer consensus: Both reviewers (claude-4.6-opus-high-thinking, gpt-5.3-codex-high) approved unanimously with no merge-blocking issues identified.
Code Quality
Both reviewers confirmed the changes are clean, focused, and internally consistent:
- All three documentation files contain identical policy text. (agreed by both)
- The
pyproject.tomlcomment header already documents the capping convention, and the new AGENTS.md policy aligns with it. (agreed by both) - Each dependency cap includes a comment explaining its purpose, and the
packagingexemption has the required explanatory comment. (noted by claude-4.6-opus)
No code-structure or maintainability issues were identified.
Test Coverage
No tests are needed. Both reviewers agreed that these are purely dependency metadata and internal documentation changes with no runtime behavior changes. The version caps do not alter any code paths.
Backwards Compatibility
Both reviewers agreed the compatibility risk is low and acceptable:
- Server dependency caps: All caps are set above the current latest PyPI versions (e.g., starlette 1.3.1 < 2, uvicorn 0.51.0 < 1, websockets 16.1 < 17), so no existing installations will be affected. (agreed by both)
- pyarrow
<25.0.0cap: Users on pyarrow 25.0.0 will be forced to downgrade, but since that version causes a crash in Streamlit, this is intentional and protective. Environments requiring pyarrow >= 25 alongside Streamlit may need dependency reconciliation. (agreed by both)
Security & Risk
No security concerns. Both reviewers confirmed the changes are protective in nature — adding upper bounds reduces exposure to unreviewed future major dependency releases, and the pyarrow pin avoids a known crash. No auth, websocket, routing, or file-serving code was modified.
External test recommendation
- Recommend external_test: No (unanimous)
- Triggered categories: None
- Evidence:
lib/pyproject.toml: Dependency bounds only, no code changeslib/AGENTS.md,.cursor/rules/python.mdc,.github/instructions/python.instructions.md: Documentation-only updates
- Suggested external_test focus areas: None
- Confidence: High
- Assumptions and gaps: None. Changes are purely declarative with no runtime, routing, auth, embedding, or networking impact.
Accessibility
No frontend changes. Not applicable. (unanimous)
Recommendations
No merge-blocking issues. Two optional follow-up suggestions from reviewers:
- Track pyarrow cap for update (claude-4.6-opus): The
pyarrow<25.0.0cap is a workaround for a specific crash, not a standard major-version cap. Once the upstream issue is resolved (in a 25.0.x patch or 26.0.0), update the cap to follow the standard<NEXT_MAJORpattern. The existing comment makes this easy to track. - CI enforcement (gpt-5.3-codex): Consider adding a lightweight CI check in a follow-up PR to flag newly added uncapped required dependencies in
lib/pyproject.toml, keeping the capping policy enforceable over time.
Verdict
APPROVED: Both reviewers unanimously approved. The PR is a clean, low-risk dependency hardening change that adds protective upper bounds to server dependencies, blocks a known pyarrow crash, and documents the capping policy consistently across all agent instruction files.
Consolidated AI review by claude-4.6-opus-high-thinking from 2 individual reviews (claude-4.6-opus-high-thinking, gpt-5.3-codex-high). All expected models completed their reviews. Please verify the feedback and use your judgment.
|
Re-ran the AI review on the full changeset (including the On the new optional follow-up about tracking the pyarrow cap: agreed. The inline comment already references apache/arrow#50471, so once that's fixed upstream (in a 25.0.x patch or 26.0.0) the cap can be relaxed to the standard |
…rver-deps # Conflicts: # lib/pyproject.toml
lukasmasuch
changed the title
## Describe your changes Raises the published `websockets` cap from `<17` to `<18` so Streamlit can install alongside websockets 17.x. The `<17` bound was the unused next-major policy cap from #15948, not a known incompatibility. Websockets 17 dropped Python 3.10, so 3.10 installs stay on 16.1.x (same pattern as pandas 3). The workspace lock pins 17.x on Python 3.11+ so CI actually exercises the new major. Python 3.10 + `websockets>=17` remains impossible because 17.x itself requires Python >= 3.11. ## GitHub Issue Link (if applicable) - Closes #17097 ## Testing Plan - No new test files: this is a dependency-range change. Existing Starlette server/websocket, logger, and FIPS smoke tests passed locally against websockets 17.1 on Python 3.13. - Min-version CI still installs `websockets==12.0.0`. Python 3.10 CI stays on 16.1.x; 3.11+ CI uses 17.1. - Unit Tests (JS and/or Python) - [x] Python unit tests (existing server/websocket/FIPS suite) --- **Contribution License Agreement** By submitting this pull request you agree that all contributions to this project are made under the Apache 2.0 license. Made with [Cursor](https://cursor.com) Co-authored-by: lawilby <[email protected]>
Describe your changes
Adds upper version bounds to previously-uncapped runtime dependencies in
lib/pyproject.toml, to minimize breakage from future major releases:starlette<2,uvicorn<1,httptools<1,anyio<5,python-multipart<1,websockets<17,itsdangerous<3. All caps sit above the currently-resolved latest versions, so no existing install is affected.pyarrowcapped at<25.0.0as a documented exemption: pyarrow 25.0.0 crashes in Streamlit's script-thread import pattern (see apache/arrow#50471). To be relaxed once the upstream issue is resolved.lib/AGENTS.md, and the generated.cursor/rules/python.mdc/.github/instructions/python.instructions.md).GitHub Issue Link (if applicable)
Testing Plan